chore(deps-dev): bump conduction/hydra-gates from 1.10.0 to 1.14.0

[dependabot]

Bumps conduction/hydra-gates from 1.10.0 to 1.14.0.

Release notes

Sourced from conduction/hydra-gates's releases.

hydra-gates v1.13.0

gate-22 manifest-validation and gate-53 effective-manifest-crossref: the vendored app-manifest-v2.schema.json is synced byte-for-byte from @conduction/nextcloud-vue 2.32.0 (#682). It now knows the root store block and the type: store page that landed fleet-wide on 2026-09-04; at v1.12.0 both gates refused every manifest that declared them (measured on openregister, portaliq, shillinq and pipelinq).

gate-67 openregister-contract-parity: contracts/ObjectServiceInterface.php mirrors openregister#3407, adding appendObjectsRaw() and purgeExpiredObjectsRaw() (#679). Contract shift per openregister#3406: the pipelinq and shillinq test doubles declare both methods (pipelinq#1766 merged, shillinq#1485 open).

No gate logic changed since v1.12.0.

v1.12.0

gate-108 shipped-object-properties — a property no schema declares is stored nowhere and reported nowhere.

OpenRegister's MagicMapper iterates the schema's declared properties and asks the data for each one, so a key with no declared property is never visited, has no column, and is silently discarded on a 200 response. A filter on such a key compiles to literal 1 = 0 and matches nothing, forever. gate-101 could not catch this: JSON Schema is open-world, and not one of the fleet's ~1,930 schemas sets additionalProperties: false.

This class cost real damage before the gate existed — publication records stripped on every save, eight drifted StUF field names duplicating mappings and dropping every async confirmation, and an XAF statutory audit file that omitted every AR customer while reporting success.

Delta-scoped on HAVE_DELTA_BASE, so pre-existing debt does not redden an untouched branch. All 21 fleet apps measured clean at tag time.

Also since v1.11.1: gate-107 personal-settings reachability (#670), and the release job now refuses to publish from a checkout the branch has moved past (#672).

Invariants on this sha: 98 suites pass, 0 real failures, 2 pre-existing quarantines with recorded reasons.

Commits

• 7150f7f fix(hydra-gates): a shared AppHost Bootstrap stub, and a manifest schema thre...
• 82efe0f Merge pull request #683 from ConductionNL/feat/global-settings-switch-to-github
• e74d8fb feat(compose): add a matomo profile for self-hosted analytics (#677)
• 134f66a Merge pull request #681 from ConductionNL/feat/global-settings-session-source...
• 918dc20 feat(global-settings): switch canonical source from Codeberg to GitHub
• a4f5c47 Merge pull request #682 from ConductionNL/chore/manifest-schema-store-page-type
• ded1055 fix(gate-22): vendored manifest schema learns the store page type and block
• d6654e0 feat(global-settings): name the canonical source in the "up to date" message
• e5c93d8 Merge pull request #680 from ConductionNL/fix/gate-4-composer-audit-retry-tra...
• 4d43971 fix(gate-4): address review nits on the composer audit retry loop
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)